The Privacy Act is set for its biggest overhaul ever. Here's how to get ready now. 

The Privacy Act is set for its biggest overhaul since its inception in 1988. The good news is being proactive now will pay dividends when the changes happen. 

2.2 million.

9.7 million.

10 million.

They are the numbers that recently turned the consumer spotlight squarely onto data security and by implication, data privacy. And while marketers might not be security experts, the reputational and brand impact of a data breach means every marketer needs to up their data game, especially regarding data privacy knowledge, strategies and tactics.

“Data collection and collation often begins with marketers on the frontline of customer-brand relationships,” Sarla Fernando, Head of Regulatory and Advocacy Advisory at ADMA, says.

“That’s where the connection is – where people provide their data. So you really need to understand how privacy fits into what you do, from the time you prepare to communicate with your audience, to when you’re collecting, managing and using data and then getting rid of or destroying it.

“By understanding both the value of the data and the responsibilities in relation to it, marketers can put the proper guardrails in place so that your brand is able to use data in the way that is both compliant and in line with how your customers expect it to be used.”

While customer expectations can vary depending on your brand, your product and your industry, regulations in the form of the Privacy Act apply to every marketer – and there are big changes ahead.

What is the Privacy Act?

The Privacy Act is the main piece of legislation governing how most entities can use personal information. It covers data collection, use, storage and how that personal information can be shared. The Privacy Act is the key privacy legislation in Australia and along with the Spam Act, the Consumer

Data Right and other channel specific legislation , it directs the way in which privacy needs to be considered. This directly impacts data-driven marketing and the day to day operations of marketers.

Why is the Privacy Act changing?

In 2019, the Australian Competition and Consumer Commission (ACCC) released the digital platforms inquiry report in which it called for Australia’s privacy laws to be reviewed to ensure they were fit for purpose. In 2020, the Attorney General’s (AGD)office began its review of the Privacy Act. This process has included the AGD releasing an issues paper and a discussion paper, and hosting a number of round table discussions with experts, industry and key stakeholders. ADMA as the leading industry body for data-driven marketing is actively engaged in this process, including responding to both papers and engaging in the roundtables.

The conclusion of the Attorney General’s review is likely to instigate substantial changes to Australian privacy laws – and will have a tangible impact on marketing. While we all wait for the AGD to complete their review, the good news is today’s Privacy Act ethos and general spirit is likely to remain. Which means we don’t need to wait to be proactive - boosting your knowledge and understanding now will pay dividends later (and potentially provide a competitive advantage as you’ll be able to adjust more quickly when the changes are announced).

What do we expect to see change in the Privacy Act?

There are two main changes we expect to fall out of this review. 

1. The definition of personal information will expand

The definition of personal information sets the scope of the Privacy Act and it is set to become broader to include technological information that may not have been clearly included previously. This will have an impact on data collected and used in marketing campaigns.

“While the Privacy Act is technology neutral and was always intended to be expansive, the types of technology and kind of data that exists today obviously wasn’t around when the Privacy Act was first introduced,” Sarla says. “To date there’s been a grey area around how the definition of personal information is applied to technical information like IP addresses, account names and other online identifiers. We’re expecting the updates to the Privacy Act to clarify that.

“It’s not that we won’t be able to use this information, but we’ll have a new set of rules on how it can be used in compliance with the Privacy Act .”

Marketers will still be able to draw on some of the data they’ve been using to help develop personas and target audiences – they just might have to do so in a different way and with more specific consent.

This clarity on what is considered compliant (or not) will be refreshing for marketers who are typically invested in doing the right thing.

2. You will need to provide more clarity up front about how information is going to be used and collected

The second main change could be around the kind of notice you’ll need to give customers. It won’t just be the fact that you are collecting data, but also how you’re going to be using that data. This means forethought and plans for use will be needed before activating data collection or capture .

“Marketers are going to have to think about what they plan to do with data upfront of their campaigns even before they try to collect it,” says Sarla. “In the past, there has been a tendency to, ‘just collect all the data a business can and then decide how to use it later.’

“Privacy laws are developing where those practices cannot continue. Marketers need to think differently and earlier about the role data will play in their whole marketing plan. Thinking about this at the strategy design stage will allow marketers to be more transparent around collection so that the correct consent can be obtained.”

The importance of a strong foundation

Even though there’s a lot of change coming, the fundamentals of Privacy remain the same. Understanding how privacy compliance applies to marketing, including how the Spam Act and the Consumer Data Right fits into that framework, is important in building your brands foundation of Consumer Trust. Learning (or taking a refresher in ) the essential principles of Privacy compliance will help you prepare your teams, practices, processes (and some instances data) for the changes that are to come. It will also help you understand where your responsibilities lie and what to look out for.